This disclosure relates generally to systems and methods for enriching events generated by a computer system. As both the size and rate of growth of computer systems have increased, more and more application service providers (ASPs) are opting to outsource their computer infrastructure. As a result, today's datacenters house very large numbers of real and virtual servers for numerous ASPs. These servers must all be monitored and dynamically reconfigured to meet the constantly changing demand for the services provided. Such monitoring and reconfigurability is necessary in order to ensure that ASPs hosted within a datacenter are provided the levels of service guaranteed by the datacenter under one or more service level agreements (SLAs). Such agreements establish levels of service that the datacenter must provide to an ASP, which are generally defined in terms of system level objectives (SLOs) or service metrics.
With servers within a single datacenter numbering in the thousands, if not the tens of thousands, monitoring system metrics and related events can be a daunting task. While event prioritizing may help datacenter operators with the task of sorting events and determining a course of action, more sophisticated systems provide additional processing of events in order to reduce the number of events presented to operators while increasing the specificity of the information provided. For example, in some existing systems events are correlated to other events in order to help identify the root cause of a cluster of what may seem like several disparate events. At least some of these systems use computed correlation coefficients to set or modify attributes within an event message (e.g., the priority value of the event).
Such systems, however, may still overwhelm operators with large numbers of event messages that are not sufficiently specific to diagnose a problem. Also, many such systems require the additional overhead of creating and maintaining service models that mirror the datacenter components and their relationships as part of the processing and prioritizing/re-prioritizing of events. These systems use such service models to provide pre-defined dependencies between system components that are relied upon to identify which events to test for correlations.